Analytics 2027: What the EU Cookie Reform Means Technically for Web Tracking

Why 2027 Becomes the Year Web Analytics Gets Rebuilt

The EU is close to allowing audience measurement without consent again – but only for a narrowly defined, technically clean measurement design. Any team still running a single tracking setup in 2027 that depends entirely on the cookie banner gives away data and risks violations at the same time.

For years, the rule in the EU has been that any access to the end device that is not strictly necessary requires consent. In Germany this is governed by § 25 TDDDG, at European level by Article 5(3) of the ePrivacy Directive. Every analytics team knows the outcome: gaps in the data, modelling instead of measurement, debates over every percentage point of consent rate.

On 2 October 2026, the Council of the EU presented a mandate text on the so-called Digital Omnibus. The text contains an exemption for first-party audience measurement that produces anonymous, aggregated information. This is not yet law. It is, however, the clearest indication since 2018 of where things are heading.

For technical analytics, this means the measurement architecture splits in two. A base layer counts without consent, while an extension layer measures in detail with consent. This article sets out what is legally on the table, what the exemption requires technically and how such a setup can already be built today.

Research as of 10 October 2026. This article is not legal advice.

The Legal Situation in October 2026

According to the current Council text, cookie rules stay in the ePrivacy Directive but receive six fixed exemptions from the consent requirement. The Commission’s original plan to move cookies into the GDPR (new Article 88a) and to make browser signals mandatory (Article 88b) has failed in the Council.

Sources: PPC Land, 9 October 2026, Acompli, September 2026, Praxikon

What the Council Text Sets Out for Analytics

Access to the end device is permitted without consent if it serves exclusively one of these six purposes and is strictly necessary for it:

1. transmission of an electronic communication
2. a service explicitly requested (e.g. shopping cart, language setting)
3. first-party audience measurement with anonymous, aggregated results
4. media audience measurement under Article 24 of the European Media Freedom Act
5. technical security of the service or the end device
6. measuring delivery and performance of contextual advertising, including frequency capping

On top of that come two rules for the banner itself. Refusing must be possible with a single click. After a refusal, consent for the same purpose may not be requested again for at least four months. In future, enforcement is to lie with the data protection supervisory authorities.

What Is Still Open

Parliament does not yet have a position. Only once both sides have a mandate do the trilogue negotiations begin, and any exemption can still change there. The European Council wants to conclude all omnibus packages by the end of 2026; an agreement in the course of 2027 is more realistic.

The deadlines are contradictory as well: the ePrivacy amendment is to apply six months after publication, yet member states get 24 months for transposition. In Germany, § 25 TDDDG would have to be amended. A reliable legal basis for consent-free measurement is therefore more likely between the end of 2027 and 2028 – enough time to prepare the technology, but too little to start only once the rules are in force.

Consent-Free Audience Measurement: What It Covers Technically

The exemption covers counting and aggregating, not profiling. Three conditions from the Council text are decisive. The measurement is carried out by the website operator itself or by a service provider acting on its behalf. The result is anonymous, aggregated information about the use of the operator’s own service. The data collected is not used for other purposes, not passed on to third parties and not combined with third-party data.

Recital 44d has the most far-reaching consequences. The recital rules out combination with data from the provider’s other services or from third parties, explicitly including analytics data from other websites. This excludes tools that pool data across customer boundaries for benchmarks or models.

The CNIL Exemption as a Technical Template

France has allowed consent-free audience measurement since the CNIL guidelines of 1 October 2020. Their requirements are the best available indication of how supervisory authorities are likely to interpret the EU exemption later. Adobe summarises them in its documentation as follows (source):

Translated into Typical Analytics Functions

The following classification is an assessment based on the Council text of 2 October 2026 and CNIL practice, not settled law.

Browser Signals: Dropped by the Council, Still Required in Practice

The mandatory browser signal (Article 88b) is no longer in the Council text, but it is not off the table. In September 2026, 19 organisations called for its return, the EDPB and EDPS support it, and Parliament can reintroduce it in the trilogue. Regardless of that, the signal is coming to browsers anyway.

The reason lies in California: the law AB 566 requires every browser to be able to send an opt-out signal for California residents by 1 January 2027. The obvious standard is Global Privacy Control (GPC), which is currently being standardised at the W3C. Firefox, Brave and DuckDuckGo already support GPC, and according to a study from May 2026 around 388,000 websites declare support (source). As a result, the signal will reach European visitors in 2027 as well.

How GPC Arrives Technically

GPC is a single bit. When it is active, the browser sends the header Sec-GPC: 1 with every request and sets navigator.globalPrivacyControl = true in the DOM. When it is inactive, the header is absent. Optionally, a website declares via /.well-known/gpc.json that it honours the signal.

// Client: check GPC status before loading the extension layer
const gpc = navigator.globalPrivacyControl === true;
if (gpc) {
  consentState.marketing = 'denied';   // refusal, not consent
}

# Server: write the header to the log to measure the GPC rate
log_format analytics '$time_iso8601 $request_uri gpc=$http_sec_gpc';

What the Signal Means – and What It Does Not

GPC can only refuse or withdraw, never consent. For the extension layer, an active GPC signal means advertising and data-sharing tags are switched off, without a banner prompt. Consent-free base measurement, on the other hand, is not affected by GPC, because purely first-party statistics fall outside its scope.

One detail is often overlooked: GPC has to be passed on server-side. Any setup that sends events to advertising platforms via server-side interfaces, such as Meta’s Conversions API, must carry the signal status in its own backend and suppress the transmission. The browser cannot do this on the server’s behalf.

Recommendation for 2027: GPC should be treated as a hard refusal now, and the GPC rate recorded as a separate metric. Should Parliament push through a mandatory signal, the logic will then already be in place.

The Two-Layer Measurement Architecture

Every event passes through a dedicated endpoint that routes it according to consent status. The base layer always receives a reduced, anonymised version, the extension layer only with consent.

The base layer answers the question “How much is happening?”: visits, page views, sources, conversions as counters. The base layer works with its own identifiers, fixed lifetimes and no disclosure of any kind. The extension layer answers “Who does what, and why?”: paths, attribution, audiences, advertising conversions.

The endpoint writes a consent_state field with three values into every event: basis (no decision yet), granted (consent given) and denied (actively refused, through the banner or GPC). This makes it possible to demonstrate at any time on which basis a record was created.

Implementation in GA4, Matomo, Server-Side Tagging and a Custom Pipeline

The base layer is best served by tools where the data does not leave the operator’s own sphere of control. GA4 belongs in the extension layer, self-hosted Matomo or a custom pipeline in the base layer.

GA4: Clearly in the Extension Layer

In Consent Mode “advanced”, GA4 sends cookieless pings even without consent, from which Google models data. This very modelling relies on data that Google evaluates across many properties. That sits poorly with recital 44d, which rules out combination with analytics data from other websites. GA4 therefore remains a tool for visitors who have consented, in Consent Mode “basic” without pings before consent.

Matomo: Configuration Close to CNIL Requirements

var _paq = window._paq = window._paq || [];
_paq.push(['setVisitorCookieTimeout', 33955200]); // 393 days, just under 13 months
_paq.push(['setReferralCookieTimeout', 0]);       // no separate campaign cookie
_paq.push(['disableBrowserFeatureDetection']);    // fewer device characteristics
_paq.push(['trackPageView']);
_paq.push(['enableLinkTracking']);

In the backend, the following are added: IP anonymisation of at least two bytes, automatic deletion of old raw data after 25 months at the latest, and disabled User ID and e-commerce customer assignment in the base property. It is important to note that Matomo extends the cookie lifetime on every visit. A fixed, non-rolling lifetime requires a small additional script that stores the date of first setting.

Server-Side Tagging: the Router Between the Layers

A first-party tagging server on a dedicated subdomain accepts all events and decides, based on consent status, where they go. Base events go only into the own analytics database. Only with consent do enriched events go to GA4, advertising platforms or a CRM.

Technically relevant: since version 16.4, Safari limits cookies set by a server with a third-party IP address to seven days. If the tagging server sits with a cloud provider rather than in the same IP range as the website, its cookies expire correspondingly fast. The solution is a reverse proxy path on the main domain, such as /metrics/, instead of a CNAME subdomain.

Custom Pipeline: a Minimal Base Beacon

// Runs without consent: page context only, no device characteristics
(function () {
  const data = {
    p: location.pathname,
    r: document.referrer ? new URL(document.referrer).hostname : '',
    u: new URLSearchParams(location.search).get('utm_source') || ''
  };
  navigator.sendBeacon('/metrics/hit', JSON.stringify(data));
})();

-- Server (ClickHouse): daily aggregation, then delete raw data
INSERT INTO daily_pages (day, path, source, hits)
SELECT toDate(ts), path, coalesce(nullIf(utm, ''), ref_host), count()
FROM raw_hits
WHERE toDate(ts) = yesterday()
GROUP BY 1, 2, 3;

ALTER TABLE raw_hits DELETE WHERE ts < now() - INTERVAL 7 DAY;

The beacon sets no cookie and reads no device characteristics. That does not automatically make it consent-free, however: EDPB Guidelines 2/2023 interpret Article 5(3) ePrivacy broadly and also cover pixels and URL-based tracking. The new measurement exemption is therefore a more robust basis than the claim of not accessing the device at all.

Data Quality: Two Layers, Two Truths

The base layer delivers reach, the extension layer delivers behaviour. The two figures inevitably contradict each other, and precisely this difference becomes the most valuable new metric: the actually measured consent rate per segment.

Extrapolating Instead of Modelling

Instead of black-box modelling by a vendor, behaviour can be extrapolated transparently. For each segment s (e.g. source × device type), a factor is formed from base and extension visits:

Ĉ = Σ_s C_ext,s · B_base,s / B_ext,s

Here C is the value of a metric in the extension layer and B is the number of visits; the index “ext” stands for the extension layer, “base” for the base layer. Segmentation matters because visitors who consent differ systematically: in practice, someone arriving via a branded search often consents more frequently than someone from a display campaign. A single global factor would hide this bias.

Never Linking the Layers via IDs

Matching takes place exclusively at aggregate level. As soon as a base ID is linked to an extension ID, the base layer is no longer anonymous and the exemption no longer applies. Technically, this means separate tables, separate identifiers and matching only via daily totals per segment.

Browser Quirks That Distort Both Layers

• Cookie lifetimes in Safari: cookies set via JavaScript live for seven days at most in Safari, and sometimes only 24 hours when the visit arrives via links with tracking parameters. “New visitors” are systematically inflated there. Metrics on returning visitors should therefore be reported separately by browser family.
• Removed click IDs: Safari’s Link Tracking Protection removes known click parameters in private windows, Mail and Messages. UTM parameters are usually preserved and are the better source information for the base layer anyway.
• Automated traffic: without a banner acting as a natural filter, the base layer sees considerably more bots. Bot detection via user agent lists, request rates and plausibility checks (e.g. a page view without any interaction) is mandatory.
• Plausibility check: base visits should be compared regularly against server or CDN logs. If the base layer deviates by more than a stable percentage, ad blockers are blocking the beacon path or the bot filter is misfiring.

Typical Mistakes During the Transition

The most common mistake will be reading the exemption as a free pass for the existing setup. The exemption allows a new, narrower measurement design, not the old one without a banner.

1. One tool for both layers with the same ID. If the base property and the property with consent share the same identifier, the separation is merely cosmetic.
2. Rolling cookie lifetimes. A cookie that extends itself by 13 months on every visit effectively lives indefinitely. CNIL practice requires a fixed expiry from first setting.
3. Disclosure via the server container. Server-side tagging merely moves data flows out of sight. If the container forwards base events to advertising platforms, that is disclosure to third parties.
4. UTM values containing personal data. Newsletter links with an email address or customer ID in the UTM parameter turn anonymous statistics into personal data. Such parameters should be removed before storage.
5. Full IP addresses in the raw data log. Truncation has to happen before writing, not in a nightly job. Web server and CDN logs count as well.
6. Consent status missing from the event. Without a field such as consent_state in every event, it is impossible later to check or demonstrate which data was collected on which basis.
7. The four-month block in the wrong storage. If the refusal is stored only in a cookie that Safari deletes after seven days, the banner may, according to the Council text, appear again. Anyone taking the rule seriously still stores the refusal in a server-set first-party cookie.
8. Waiting for the final law. The changes to data model, tagging server and reporting take months. Anyone who starts only once the rules are in force will measure another year with gaps.

Checklist for 2027

These points can be implemented regardless of the final legal text, because they are cleaner under current law and necessary under future law.

Inventory

• Inventory of all tags, pixels and server-side forwards, each with purpose and recipient
• Assignment of every tag to a layer: base (planned as consent-free) or extension (consent required)
• Review of which tools use data for their own purposes, benchmarks or models

Building the Base Layer

• Self-hosted Matomo or a custom beacon pipeline, separate from the extension property
• Cookie lifetime fixed at a maximum of 13 months, without extension on every visit
• IP truncation before storage, including in web server and CDN logs
• Deletion of raw data after 25 months at the latest, preferably after aggregation
• Removal of personal values from UTM and query parameters
• A bot filter, checked for plausibility against server logs
• An opt-out mechanism for base measurement

Extension Layer and Signals

• Refusal with a single click, on equal footing with acceptance
• Refusal stored server-side for at least four months
• GPC (Sec-GPC and navigator.globalPrivacyControl) treated as a hard refusal
• GPC and consent status passed through to server-side interfaces

Reporting

• A consent_state field in every event
• Reach reported from the base layer, behaviour from the extension layer
• Consent rate and GPC rate per source and device as fixed metrics
• Extrapolation only by segment, never with a global factor
• Metrics on returning visitors separated by browser family

Conclusion

2027 will decide whether web analytics in the EU may once again deliver complete reach figures. The Council text of 2 October 2026 points the way: measurement yes, profiling no. What is rewarded is a measurement design that deliberately forgoes personal reference, disclosure and linking for data collected without consent.

The two-layer architecture is not a stopgap but the better setup. The architecture separates clean reach from detailed behaviour, makes the consent rate exactly measurable for the first time and replaces opaque modelling with traceable extrapolation. The final legal text may still shift details. That changes little about the basic architecture – and anyone who has built it by mid-2027 will be finished on the day the rules take effect rather than just starting a project.